Option 1: Do it yourself
Follow the steps in this guide. Free, and typically 30 minutes to a few hours of careful work.
Option 2: Just contact us
Skip every step below. $49/mo and it is sorted, or WhatsApp us right now.
Last updated: August 2026
How do I know it's actually a hack?
Before you panic, confirm it. These are the signs that mean compromise, not malfunction:
- Your homepage shows content you didn't publish (pharmacy spam, foreign-language text, a "hacked by" page)
- Google search results for your brand show strange titles or Japanese/pharma keywords
- Visitors get redirected to another site
- Chrome shows "Deceptive site ahead" or Search Console emails you a security warning
- New admin users appear that nobody on your team created
A white screen, a database error, or a broken layout after an update is usually not a hack, that's a technical failure with a different fix.
The first 60 minutes, step by step
Minutes 0-10: Preserve, don't destroy. Screenshot what visitors see, what Google shows, and any warning pages. Note the date and time you noticed it. If you have cyber insurance or take card payments, you may need this evidence later.
Minutes 10-20: Lock the doors. From a device you trust (not the possibly-infected office PC), change your hosting account password, your CMS admin passwords, your database password, and your FTP/SFTP credentials. If your host offers it, enable two-factor authentication right now. This matters because attackers often keep a valid password even after you clean the files.
Minutes 20-30: Take the site offline gracefully. Use your host's maintenance mode or a simple holding page. Don't just delete things, you need the infected files intact for diagnosis. If the site is actively serving malware to visitors, going dark for a few hours protects both your visitors and your reputation with Google.
Minutes 30-45: Copy the crime scene. Download a full copy of the current files and database. Yes, the infected version. Cleanup pros work by comparing infected files against clean originals; without the infected copy, they're guessing.
Minutes 45-60: Find your last clean backup. Check what backups exist and when they were taken. A backup from before the infection is the fastest road back. One warning: if you don't know when the hack happened, a recent backup may already contain the backdoor. This is why cleanup usually beats blind restore.
How long does recovery take, and what does it cost?
A straightforward infection on a WordPress site takes 2-6 hours of skilled work to clean. Complicated cases, no backups, multiple backdoors, Google blacklisting, take 1-3 days including the blacklist review. Professional malware removal in the US typically costs $150-$1,000 as a one-time job, depending on severity and whether the site was blacklisted.
The blacklist part matters more than most owners realize: once Google flags your site, you'll need to clean it and submit a review through Search Console, which takes anywhere from a few hours to about 72 hours to process.
Should I clean it myself or hire someone?
Do it yourself if: you're comfortable in cPanel/SSH, you have a verified pre-infection backup, and the infection is limited to obvious injected files.
Get help if: you take payments on the site, Google has already flagged you, you can't find how they got in, or the hack keeps coming back after cleanup. A reinfection within days means there's a backdoor you missed, and every reinfection extends the Google penalty.
We handle hacked-site cleanups as a flat-quoted one-time fix, and every maintenance plan we run includes the firewall, scanning and hardening that make round two dramatically less likely.
FAQ
Should I pay the ransom if my site shows a ransom demand? No. Website defacement "ransoms" are almost never real leverage, your files are still on the server, and a clean backup or professional cleanup restores everything without paying.
Will my rankings recover after a hack? Usually yes, within 2-8 weeks of a clean bill of health from Google, provided the spam pages are removed and return proper 404/410 codes.
How did they get in? The overwhelming majority of small-site hacks come through outdated plugins/themes, weak or reused passwords, or nulled (pirated) themes carrying pre-installed malware. Your cleanup isn't finished until the entry point is identified and closed.
Do I need to tell my customers? If the site stores or processes customer data and that data may have been accessed, you may have notification obligations under state privacy laws. When in doubt, ask a lawyer, and be honest early rather than exposed later.
You do not have to do any of this yourself
Skip the steps above. Our engineers handle security, updates, speed, backups and fixes for you, with a 12-minute average response and a 99.99% uptime target.